From b8b3efda483d7a12edab1b52573abb900cab3886 Mon Sep 17 00:00:00 2001
From: KIMBOH LOVETTE <37558983+Kimbohlovette@users.noreply.github.com>
Date: Wed, 7 May 2025 11:24:18 +0100
Subject: [PATCH] [GH-25995]_Validate SITE URL in mmctl auth login (#30362)

---
 server/cmd/mmctl/commands/auth.go | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/server/cmd/mmctl/commands/auth.go b/server/cmd/mmctl/commands/auth.go
index 291adfded9..20685c183d 100644
--- a/server/cmd/mmctl/commands/auth.go
+++ b/server/cmd/mmctl/commands/auth.go
@@ -7,6 +7,8 @@ import (
 	"bufio"
 	"context"
 	"fmt"
+	"net/http"
+	"net/url"
 	"os"
 	"sort"
 	"strings"
@@ -164,7 +166,20 @@ func loginCmdF(cmd *cobra.Command, args []string) error {
 	allowInsecureSHA1 := viper.GetBool("insecure-sha1-intermediate")
 	allowInsecureTLS := viper.GetBool("insecure-tls-version")
 
-	url := strings.TrimRight(args[0], "/")
+	instanceURL := strings.TrimRight(args[0], "/")
+	_, err = url.ParseRequestURI(instanceURL)
+	if err != nil {
+		return fmt.Errorf("could not parse the instance url: %w", err)
+	}
+
+	res, err := http.Get(instanceURL)
+	if err != nil {
+		return fmt.Errorf("could not get instance status: %w", err)
+	}
+	if res.StatusCode != 200 {
+		return fmt.Errorf("instance status code is not 200: %d", res.StatusCode)
+	}
+
 	method := MethodPassword
 
 	ctx := context.TODO()
@@ -206,10 +221,10 @@ func loginCmdF(cmd *cobra.Command, args []string) error {
 		var c *model.Client4
 		var err error
 		if mfaToken != "" {
-			c, _, err = InitClientWithMFA(ctx, username, password, mfaToken, url, allowInsecureSHA1, allowInsecureTLS)
+			c, _, err = InitClientWithMFA(ctx, username, password, mfaToken, instanceURL, allowInsecureSHA1, allowInsecureTLS)
 			method = MethodMFA
 		} else {
-			c, _, err = InitClientWithUsernameAndPassword(ctx, username, password, url, allowInsecureSHA1, allowInsecureTLS)
+			c, _, err = InitClientWithUsernameAndPassword(ctx, username, password, instanceURL, allowInsecureSHA1, allowInsecureTLS)
 		}
 		if err != nil {
 			return fmt.Errorf("could not initiate client: %w", err)
@@ -219,7 +234,7 @@ func loginCmdF(cmd *cobra.Command, args []string) error {
 		username = "Personal Access Token"
 		method = MethodToken
 		credentials := Credentials{
-			InstanceURL: url,
+			InstanceURL: instanceURL,
 			AuthToken:   accessToken,
 		}
 		if _, _, err := InitClientWithCredentials(ctx, &credentials, allowInsecureSHA1, allowInsecureTLS); err != nil {
@@ -229,7 +244,7 @@ func loginCmdF(cmd *cobra.Command, args []string) error {
 
 	credentials := Credentials{
 		Name:        name,
-		InstanceURL: url,
+		InstanceURL: instanceURL,
 		Username:    username,
 		AuthToken:   accessToken,
 		AuthMethod:  method,
@@ -246,7 +261,7 @@ func loginCmdF(cmd *cobra.Command, args []string) error {
 		}
 	}
 
-	printer.Print(fmt.Sprintf("\n  credentials for %q: \"%s@%s\" stored\n", name, username, url))
+	printer.Print(fmt.Sprintf("\n  credentials for %q: \"%s@%s\" stored\n", name, username, instanceURL))
 	return nil
 }